@oculum/scanner 1.0.14 → 1.0.15

package/dist/detect/ast-rules/helpers/type-extraction.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * AST Type Extraction Helpers
+ *
+ * Thin compatibility layer that delegates to the standalone type-extractor
+ * module for shared types/functions, and keeps helper-specific functions
+ * (operating on individual AST nodes) here.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSecurityRelevantType = void 0;
+exports.extractParameterTypes = extractParameterTypes;
+exports.extractReturnType = extractReturnType;
+exports.extractVariableType = extractVariableType;
+exports.extractGenericConstraints = extractGenericConstraints;
+exports.hasZodInferredType = hasZodInferredType;
+exports.hasRequestType = hasRequestType;
+exports.hasAnyType = hasAnyType;
+// Re-export shared functions from the standalone module
+var type_extractor_1 = require("../../../parse/type-extractor");
+Object.defineProperty(exports, "isSecurityRelevantType", { enumerable: true, get: function () { return type_extractor_1.isSecurityRelevantType; } });
+/**
+ * Extract type annotations from function parameters.
+ */
+function extractParameterTypes(fnNode) {
+    const params = fnNode.childForFieldName('parameters');
+    if (!params)
+        return [];
+    const result = [];
+    for (const param of params.namedChildren) {
+        if (param.type === 'required_parameter' || param.type === 'optional_parameter') {
+            const pattern = param.childForFieldName('pattern');
+            const typeAnnotation = param.childForFieldName('type');
+            result.push({
+                name: pattern?.text ?? param.text,
+                type: typeAnnotation?.text?.replace(/^:\s*/, '') ?? null,
+                optional: param.type === 'optional_parameter',
+            });
+        }
+        else if (param.type === 'identifier') {
+            // Plain JS parameter (no type annotation)
+            result.push({
+                name: param.text,
+                type: null,
+                optional: false,
+            });
+        }
+    }
+    return result;
+}
+/**
+ * Extract return type annotation from a function.
+ */
+function extractReturnType(fnNode) {
+    const returnType = fnNode.childForFieldName('return_type');
+    if (!returnType)
+        return null;
+    return returnType.text.replace(/^:\s*/, '');
+}
+/**
+ * Extract type annotation from a variable declaration.
+ */
+function extractVariableType(declarator) {
+    if (declarator.type !== 'variable_declarator')
+        return null;
+    const typeAnnotation = declarator.childForFieldName('type');
+    if (!typeAnnotation)
+        return null;
+    return typeAnnotation.text.replace(/^:\s*/, '');
+}
+// ============================================================================
+// Generic Type Extraction
+// ============================================================================
+/**
+ * Extract generic type constraints from a type node.
+ * e.g., `Promise<Response>` -> ['Response']
+ */
+function extractGenericConstraints(typeNode) {
+    const constraints = [];
+    const typeArgs = typeNode.descendantsOfType('type_arguments');
+    for (const args of typeArgs) {
+        for (const child of args.namedChildren) {
+            if (child.type === 'type_identifier' || child.type === 'generic_type') {
+                constraints.push(child.text);
+            }
+        }
+    }
+    return constraints;
+}
+/**
+ * Check if a type node uses z.infer<typeof schema> pattern (Zod).
+ */
+function hasZodInferredType(typeNode) {
+    const text = typeNode.text;
+    return /z\.infer\s*<\s*typeof\s+\w+/.test(text) ||
+        /z\.output\s*<\s*typeof\s+\w+/.test(text) ||
+        /z\.input\s*<\s*typeof\s+\w+/.test(text);
+}
+/**
+ * Check if a function parameter has a Request-like type annotation.
+ */
+function hasRequestType(paramNode) {
+    const typeAnnotation = paramNode.childForFieldName('type');
+    if (!typeAnnotation)
+        return false;
+    return /Request|NextRequest|NextApiRequest|IncomingMessage|FastifyRequest/.test(typeAnnotation.text);
+}
+/**
+ * Check if a function has any parameters with 'any' type.
+ */
+function hasAnyType(fnNode) {
+    const params = fnNode.childForFieldName('parameters');
+    if (!params)
+        return false;
+    for (const param of params.namedChildren) {
+        const typeAnnotation = param.childForFieldName('type');
+        if (typeAnnotation?.text?.replace(/^:\s*/, '') === 'any')
+            return true;
+    }
+    // Also check return type
+    const returnType = fnNode.childForFieldName('return_type');
+    if (returnType?.text?.replace(/^:\s*/, '') === 'any')
+        return true;
+    return false;
+}
+//# sourceMappingURL=type-extraction.js.map

package/dist/detect/ast-rules/helpers/type-extraction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-extraction.js","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/type-extraction.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAoBH,sDA2BC;AAKD,8CAIC;AAKD,kDAMC;AAUD,8DAaC;AAKD,gDAKC;AAKD,wCAOC;AAKD,gCAcC;AA/HD,wDAAwD;AACxD,gEAAsE;AAA7D,wHAAA,sBAAsB,OAAA;AAY/B;;GAEG;AACH,SAAgB,qBAAqB,CAAC,MAAyB;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAEtB,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;YAClD,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YAEtD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI;gBACjC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI;gBACxD,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,oBAAoB;aAC9C,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACvC,0CAA0C;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAC7C,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,UAA6B;IAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,IAAI,CAAA;IAE1D,MAAM,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC3D,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAA;IAChC,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,QAA2B;IACnE,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;IAE7D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACtE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,QAA2B;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,OAAO,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;QACzC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACjD,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,SAA4B;IACzD,MAAM,cAAc,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC1D,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAA;IAEjC,OAAO,mEAAmE,CAAC,IAAI,CAC7E,cAAc,CAAC,IAAI,CACpB,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,MAAyB;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAA;IACvE,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;IAC1D,IAAI,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAEjE,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/detect/ast-rules/helpers/user-input.d.ts

@@ -0,0 +1,35 @@
+/**
+ * AST User Input & Dangerous Sink Detection Helpers
+ *
+ * Identifies user input sources (req.body, req.query, etc.),
+ * LLM output expressions, and dangerous code sinks.
+ */
+import type Parser from 'tree-sitter';
+/**
+ * Check if a node accesses user input (req.body, req.query, etc.).
+ */
+export declare function isUserInputExpression(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a node accesses LLM output content.
+ */
+export declare function isLLMOutputExpression(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a call_expression is a known dangerous sink.
+ */
+export declare function isDangerousSink(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if an assignment target is a dangerous DOM property.
+ * e.g., el.innerHTML = userInput
+ */
+export declare function isDangerousPropertyAssignment(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a function is an Express/Next.js/Fastify route handler.
+ * Looks at parameter names/types for (req, res) or (request, response) patterns.
+ */
+export declare function isRequestHandler(fnNode: Parser.SyntaxNode): boolean;
+/**
+ * Collect all user input access points in a file.
+ * Returns nodes that access request data.
+ */
+export declare function getUserInputSources(root: Parser.SyntaxNode): Parser.SyntaxNode[];
+//# sourceMappingURL=user-input.d.ts.map

package/dist/detect/ast-rules/helpers/user-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-input.d.ts","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/user-input.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAkCrC;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAsCtE;AAsBD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAOtE;AAkCD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAwBhE;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAQ9E;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAsCnE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAYhF"}

package/dist/detect/ast-rules/helpers/user-input.js

@@ -0,0 +1,243 @@
+"use strict";
+/**
+ * AST User Input & Dangerous Sink Detection Helpers
+ *
+ * Identifies user input sources (req.body, req.query, etc.),
+ * LLM output expressions, and dangerous code sinks.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUserInputExpression = isUserInputExpression;
+exports.isLLMOutputExpression = isLLMOutputExpression;
+exports.isDangerousSink = isDangerousSink;
+exports.isDangerousPropertyAssignment = isDangerousPropertyAssignment;
+exports.isRequestHandler = isRequestHandler;
+exports.getUserInputSources = getUserInputSources;
+const ast_1 = require("../../../parse/ast");
+// ============================================================================
+// User Input Detection
+// ============================================================================
+/** Known user input property paths */
+const USER_INPUT_PATTERNS = [
+    // Express / generic
+    { object: /^req(uest)?$/, property: 'body' },
+    { object: /^req(uest)?$/, property: 'query' },
+    { object: /^req(uest)?$/, property: 'params' },
+    { object: /^req(uest)?$/, property: 'headers' },
+    { object: /^req(uest)?$/, property: 'cookies' },
+    { object: /^req(uest)?$/, property: /^(get|header)$/ },
+    // Koa
+    { object: /^ctx$/, property: /^request$/ },
+    { object: /^ctx\.request$/, property: 'body' },
+    { object: /^ctx\.request$/, property: 'query' },
+    // Next.js App Router
+    { object: /^(req|request)$/, property: 'json' },
+    { object: /^(req|request)$/, property: 'text' },
+    { object: /^(req|request)$/, property: 'formData' },
+    // Fastify
+    { object: /^(req|request)$/, property: 'body' },
+    { object: /^(req|request)$/, property: 'query' },
+    { object: /^(req|request)$/, property: 'params' },
+    // Hono
+    { object: /^c$/, property: /^req$/ },
+    // URL search params
+    { object: /searchParams/, property: /^(get|getAll)$/ },
+];
+/**
+ * Check if a node accesses user input (req.body, req.query, etc.).
+ */
+function isUserInputExpression(node) {
+    if (node.type === 'member_expression') {
+        const obj = node.childForFieldName('object');
+        const prop = node.childForFieldName('property');
+        if (!obj || !prop)
+            return false;
+        for (const pattern of USER_INPUT_PATTERNS) {
+            const objMatch = pattern.object.test(obj.text);
+            const propMatch = typeof pattern.property === 'string'
+                ? prop.text === pattern.property
+                : pattern.property.test(prop.text);
+            if (objMatch && propMatch)
+                return true;
+        }
+        // Recursive: req.body.username (user input with property access)
+        if (isUserInputExpression(obj))
+            return true;
+    }
+    // Destructured from request: const { body } = req
+    if (node.type === 'identifier') {
+        const name = node.text;
+        if (['body', 'query', 'params'].includes(name)) {
+            // Check if destructured from request-like object
+            const fn = (0, ast_1.findEnclosingFunction)(node);
+            if (fn) {
+                const params = fn.childForFieldName('parameters');
+                if (params) {
+                    const destructured = params.descendantsOfType('object_pattern');
+                    for (const d of destructured) {
+                        const props = d.descendantsOfType('shorthand_property_identifier_pattern');
+                        if (props.some(p => p.text === name))
+                            return true;
+                    }
+                }
+            }
+        }
+    }
+    return false;
+}
+// ============================================================================
+// LLM Output Detection
+// ============================================================================
+/** Patterns that indicate LLM API response content */
+const LLM_OUTPUT_PATTERNS = [
+    /response\.choices\[?\d*\]?\.message\.content/,
+    /completion\.choices\[?\d*\]?\.message\.content/,
+    /result\.choices\[?\d*\]?\.message\.content/,
+    /response\.data\.choices/,
+    /response\.content\[?\d*\]?\.text/, // Anthropic SDK
+    /message\.content/,
+    /output\.text/,
+    /response\.text/,
+    /result\.text/,
+    /generation\.text/,
+    /\.generated_text/,
+    /\.output_text/,
+];
+/**
+ * Check if a node accesses LLM output content.
+ */
+function isLLMOutputExpression(node) {
+    if (node.type !== 'member_expression' && node.type !== 'subscript_expression') {
+        return false;
+    }
+    const fullText = node.text;
+    return LLM_OUTPUT_PATTERNS.some(p => p.test(fullText));
+}
+// ============================================================================
+// Dangerous Sinks
+// ============================================================================
+/** Known dangerous function sinks */
+const DANGEROUS_SINKS = new Set([
+    'eval',
+    'Function',
+    'setTimeout', // when called with string arg
+    'setInterval', // when called with string arg
+    'execSync',
+    'exec',
+    'execFile',
+    'spawn',
+    'spawnSync',
+    'fork',
+]);
+const DANGEROUS_MEMBER_SINKS = [
+    { object: /^(document|window)$/, method: 'write' },
+    { object: /^document$/, method: 'writeln' },
+    { object: /^(child_process|cp)$/, method: 'exec' },
+    { object: /^(child_process|cp)$/, method: 'execSync' },
+    { object: /^(child_process|cp)$/, method: 'spawn' },
+];
+const DANGEROUS_PROPERTY_SINKS = new Set([
+    'innerHTML',
+    'outerHTML',
+    'insertAdjacentHTML',
+]);
+/**
+ * Check if a call_expression is a known dangerous sink.
+ */
+function isDangerousSink(node) {
+    if (node.type !== 'call_expression')
+        return false;
+    const fn = node.childForFieldName('function');
+    if (!fn)
+        return false;
+    // Direct call: eval(...)
+    if (fn.type === 'identifier' && DANGEROUS_SINKS.has(fn.text))
+        return true;
+    // Member call: child_process.exec(...)
+    if (fn.type === 'member_expression') {
+        const obj = fn.childForFieldName('object');
+        const prop = fn.childForFieldName('property');
+        if (obj && prop) {
+            // Check member sinks
+            for (const sink of DANGEROUS_MEMBER_SINKS) {
+                if (sink.object.test(obj.text) && prop.text === sink.method)
+                    return true;
+            }
+            // Check property sinks (used as function: el.insertAdjacentHTML())
+            if (DANGEROUS_PROPERTY_SINKS.has(prop.text))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check if an assignment target is a dangerous DOM property.
+ * e.g., el.innerHTML = userInput
+ */
+function isDangerousPropertyAssignment(node) {
+    if (node.type !== 'assignment_expression')
+        return false;
+    const left = node.childForFieldName('left');
+    if (left?.type !== 'member_expression')
+        return false;
+    const prop = left.childForFieldName('property');
+    return prop ? DANGEROUS_PROPERTY_SINKS.has(prop.text) : false;
+}
+// ============================================================================
+// Request Handler Detection
+// ============================================================================
+/**
+ * Check if a function is an Express/Next.js/Fastify route handler.
+ * Looks at parameter names/types for (req, res) or (request, response) patterns.
+ */
+function isRequestHandler(fnNode) {
+    const params = fnNode.childForFieldName('parameters');
+    if (!params)
+        return false;
+    const paramNames = params.namedChildren
+        .map(p => {
+        if (p.type === 'identifier')
+            return p.text;
+        const pattern = p.childForFieldName('pattern');
+        return pattern?.text ?? p.text;
+    })
+        .filter(Boolean);
+    // (req, res) or (request, response) or (ctx) or (c) patterns
+    if (paramNames.length >= 2) {
+        const [first, second] = paramNames;
+        if ((/^req(uest)?$/i.test(first) && /^res(ponse)?$/i.test(second)) ||
+            (/^ctx$/i.test(first)) ||
+            (/^c$/i.test(first) && paramNames.length <= 2)) {
+            return true;
+        }
+    }
+    // Next.js App Router: single Request param or NextRequest
+    if (paramNames.length >= 1) {
+        // Check type annotations
+        const firstParam = params.namedChildren[0];
+        if (firstParam) {
+            const typeAnnotation = firstParam.childForFieldName('type');
+            if (typeAnnotation) {
+                const typeText = typeAnnotation.text;
+                if (/Request|NextRequest|NextApiRequest/.test(typeText))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Collect all user input access points in a file.
+ * Returns nodes that access request data.
+ */
+function getUserInputSources(root) {
+    const sources = [];
+    (0, ast_1.walkAST)(root, (node) => {
+        if (isUserInputExpression(node)) {
+            sources.push(node);
+            return true; // skip children (avoid double-counting nested access)
+        }
+        return false;
+    });
+    return sources;
+}
+//# sourceMappingURL=user-input.js.map

package/dist/detect/ast-rules/helpers/user-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-input.js","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/user-input.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAuCH,sDAsCC;AAyBD,sDAOC;AAqCD,0CAwBC;AAMD,sEAQC;AAUD,4CAsCC;AAMD,kDAYC;AAvPD,4CAAmE;AAEnE,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,sCAAsC;AACtC,MAAM,mBAAmB,GAAyD;IAChF,oBAAoB;IACpB,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC5C,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC7C,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC9C,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC/C,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC/C,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACtD,MAAM;IACN,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE;IAC1C,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC9C,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC/C,qBAAqB;IACrB,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC/C,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC/C,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE;IACnD,UAAU;IACV,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC/C,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE;IAChD,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACjD,OAAO;IACP,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACpC,oBAAoB;IACpB,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE;CACvD,CAAA;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,IAAuB;IAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;QAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QAE/B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC9C,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBACpD,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ;gBAChC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpC,IAAI,QAAQ,IAAI,SAAS;gBAAE,OAAO,IAAI,CAAA;QACxC,CAAC;QAED,iEAAiE;QACjE,IAAI,qBAAqB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IAC7C,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,iDAAiD;YACjD,MAAM,EAAE,GAAG,IAAA,2BAAqB,EAAC,IAAI,CAAC,CAAA;YACtC,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,MAAM,GAAG,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBACjD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;oBAC/D,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;wBAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,uCAAuC,CAAC,CAAA;wBAC1E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;4BAAE,OAAO,IAAI,CAAA;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,sDAAsD;AACtD,MAAM,mBAAmB,GAAG;IAC1B,8CAA8C;IAC9C,gDAAgD;IAChD,4CAA4C;IAC5C,yBAAyB;IACzB,kCAAkC,EAAG,gBAAgB;IACrD,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;CAChB,CAAA;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,IAAuB;IAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAA;IAC1B,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,qCAAqC;AACrC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM;IACN,UAAU;IACV,YAAY,EAAG,8BAA8B;IAC7C,aAAa,EAAE,8BAA8B;IAC7C,UAAU;IACV,MAAM;IACN,UAAU;IACV,OAAO;IACP,WAAW;IACX,MAAM;CACP,CAAC,CAAA;AAEF,MAAM,sBAAsB,GAA8C;IACxE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE;IAClD,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;IAC3C,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE;IAClD,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,UAAU,EAAE;IACtD,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE;CACpD,CAAA;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,WAAW;IACX,WAAW;IACX,oBAAoB;CACrB,CAAC,CAAA;AAEF;;GAEG;AACH,SAAgB,eAAe,CAAC,IAAuB;IACrD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAEjD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAErB,yBAAyB;IACzB,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAEzE,uCAAuC;IACvC,IAAI,EAAE,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,qBAAqB;YACrB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAA;YAC1E,CAAC;YACD,mEAAmE;YACnE,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,6BAA6B,CAAC,IAAuB;IACnE,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB;QAAE,OAAO,KAAK,CAAA;IAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,IAAI,EAAE,IAAI,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAA;IAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC/D,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAAyB;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEzB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE;QACP,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,CAAC,CAAC,IAAI,CAAA;QAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAC9C,OAAO,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,CAAA;IAChC,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC,CAAA;IAElB,6DAA6D;IAC7D,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,UAAU,CAAA;QAClC,IACE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,EAC9C,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC3B,yBAAyB;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAC1C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YAC3D,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAA;gBACpC,IAAI,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,IAAI,CAAA;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,IAAuB;IACzD,MAAM,OAAO,GAAwB,EAAE,CAAA;IAEvC,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,OAAO,IAAI,CAAA,CAAC,sDAAsD;QACpE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/detect/ast-rules/index.d.ts

@@ -0,0 +1,112 @@
+/**
+ * AST Rule Engine
+ *
+ * Defines and runs AST-based detection rules against tree-sitter parse trees.
+ * Rules declare patterns (node types, matchers, context checks) and produce
+ * Vulnerability objects compatible with the existing pipeline.
+ *
+ * This is the v2 foundation — new detectors should be written as AST rules
+ * rather than regex patterns.
+ */
+import type Parser from 'tree-sitter';
+import type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, TaintPathOutput, EvidenceLevel } from '../../shared/types';
+import type { ParsedAST } from '../../parse/ast';
+import { type NodeIndex } from '../../parse/node-index';
+export { type NodeIndex, getNodes } from '../../parse/node-index';
+export interface ASTRuleMatch {
+    node: Parser.SyntaxNode;
+    /** Override severity for this specific match (optional) */
+    severity?: VulnerabilitySeverity;
+    /** Override category for this specific match (optional, used by LLM taint routing) */
+    category?: VulnerabilityCategory;
+    /** Extra context to append to the description */
+    note?: string;
+    /** Serialized taint path (from taint-flow-ast.ts) */
+    taintPath?: TaintPathOutput;
+    /** Evidence level classification */
+    evidenceLevel?: EvidenceLevel;
+    /** Context-specific fix steps (from taint-fix-templates) */
+    fixSteps?: string[];
+}
+/**
+ * An AST detection rule.
+ *
+ * Rules are functions that receive the AST root + file metadata and return
+ * an array of matches. The engine converts matches into Vulnerability objects.
+ */
+export interface ASTRule {
+    /** Unique rule ID (e.g., 'ast-weak-crypto-math-random') */
+    id: string;
+    /** Human-readable title shown in findings */
+    title: string;
+    /** Default description for findings */
+    description: string;
+    /** Default severity */
+    severity: VulnerabilitySeverity;
+    /** Vulnerability category */
+    category: VulnerabilityCategory;
+    /** Default suggested fix */
+    suggestedFix?: string;
+    /** Which languages this rule applies to */
+    languages: Array<'javascript' | 'typescript' | 'tsx' | 'python'>;
+    /** Confidence level */
+    confidence: 'high' | 'medium' | 'low';
+    /** Base confidence score for the scoring engine */
+    baseConfidence?: number;
+    /** Whether this finding requires AI validation */
+    requiresAIValidation?: boolean;
+    /** Detection layer (1 = pattern, 2 = structural). Defaults to 2 for AST rules. */
+    layer?: 1 | 2 | 3;
+    /** Detector group source. Defaults to 'structural'. */
+    source?: 'secrets' | 'structural' | 'ai_code' | 'config';
+    /**
+     * The detection function. Receives the parsed AST and returns matched nodes.
+     * Should be fast — no I/O, no network calls.
+     */
+    detect(ast: ParsedAST, content: string, nodeIndex?: NodeIndex): ASTRuleMatch[];
+}
+/**
+ * Register an AST rule. Called by individual rule modules during import.
+ */
+export declare function registerASTRule(rule: ASTRule): void;
+/**
+ * Get all registered AST rules.
+ */
+export declare function getASTRules(): readonly ASTRule[];
+/**
+ * Run all applicable AST rules against a single parsed file.
+ * Returns Vulnerability objects ready for the pipeline.
+ */
+export declare function runASTRules(ast: ParsedAST, content: string): Vulnerability[];
+/**
+ * Run all applicable AST rules across multiple parsed files.
+ */
+export declare function runASTRulesOnFiles(asts: Map<string, ParsedAST>, files: Array<{
+    path: string;
+    content: string;
+}>): Vulnerability[];
+/**
+ * Collect all import bindings from the top level of a file.
+ * Returns a map of local name → { source module, original name }.
+ *
+ * Handles:
+ *  - import { foo } from 'mod'
+ *  - import { foo as bar } from 'mod'
+ *  - import foo from 'mod'
+ *  - const { foo } = require('mod')
+ */
+export declare function collectImportBindings(root: Parser.SyntaxNode): Map<string, {
+    module: string;
+    originalName: string;
+}>;
+/**
+ * Check if a call_expression node calls a specific function name
+ * (handles both direct calls and member expressions like crypto.createHash).
+ */
+export declare function isCallTo(node: Parser.SyntaxNode, name: string): boolean;
+/**
+ * Get the string value of the first argument to a call expression.
+ * Returns null if the first arg isn't a string literal.
+ */
+export declare function getFirstStringArg(callNode: Parser.SyntaxNode): string | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/detect/ast-rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/detect/ast-rules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACrI,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,OAAO,EAAE,KAAK,SAAS,EAAkC,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAMjE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,sFAAsF;IACtF,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qDAAqD;IACrD,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,oCAAoC;IACpC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAA;IACV,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAA;IACb,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,uBAAuB;IACvB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,6BAA6B;IAC7B,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,SAAS,EAAE,KAAK,CAAC,YAAY,GAAG,YAAY,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAA;IAChE,uBAAuB;IACvB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;IACrC,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,kFAAkF;IAClF,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxD;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,YAAY,EAAE,CAAA;CAC/E;AAQD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAEnD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,SAAS,OAAO,EAAE,CAEhD;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,MAAM,GACd,aAAa,EAAE,CA+CjB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,EAC5B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9C,aAAa,EAAE,CAajB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,GAAG,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAoEvD;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAevE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAsB5E"}